Home
All Topics
Governance, Risk & Compliance

Peer-Driven Insights

Governance, Risk & Compliance

Active Ambassadors in This Topic

Rathik Pathak

JM Financial Services Ltd

Travel and Hospitality, 1k - 5k

View All Community Ambassadors

What sets us apart?

No selling.

No recruiting.

No self promotion.

Read Our GuidelinesTrusted peer advice and insights for technology professionals.

Related Topics

Awareness & Training
Data Privacy & Protection
Identity & Access Management (IAM)
Regulatory Compliance
Risk Management

Community Guidelines Rules of Engagement FAQs Directory of ambassadors Privacy Terms of Service

© 2025 Gartner, Inc. and/or its affiliates. All rights reserved.

Community Posts

What models are in place for risk partners based in Line 2? What are the jobs to be done? How do they operate? What does the structure/operating rythms look like?

Read More Comments

What does the blueprint look like at your org for a minimal viable organizational structure needed to run an AI governance program?

I’m in the process of developing and formalizing the Risk Appetite Statement (RAS) for my organization, a public transport operator. Before we bring the draft to the Board, I’d appreciate your views on the best approach for engaging the Senior Leadership Team (SLT): Is 1:1 engagement more effective to gather candid input? Or would a group workshop be better to align perspectives and drive collective ownership? If anyone has experience developing a RAS specifically for a public transport or infrastructure-focused entity, I’d love to hear your lessons learned or key considerations. Appreciate any tips or tools!

Read More Comments

CISO here at a large enterprise—between NIS2, DORA, the Cyber Resilience Act, and growing internal pressure around shadow AI and ransomware response, it feels like we’re constantly balancing compliance overhead with real operational risk. What’s the one thing you’re losing the most sleep over in 2025?

Is red teaming a better way to demonstrate security needs to the board than traditional compliance audits?

Read More Comments

How is your organization mitigating risks from smart wearables or covert recording devices during sensitive conversations? Please share any relevant policies, technical solutions, or experiences managing this challenge.

I'm interested in understanding how your organizations estimate the complexity of digital initiatives, particularly as a basis for applying appropriate project management governance. In other words, how do you assess initiative complexity in order to determine the level or type of governance needed?

Read More Comments

Seeking insights for research universities regarding CMMC 2.0 adoption and compliance. I'm listing our full question set below, but we would welcome insights on any or all of these:

1. What is the anticipated timeline for CMMC 2.0 adoption by the Federal Government? Any insights on the expected rollout and implementation schedule?

2. From a Higher Ed CIO perspective, what are the key operational differences between each "level" in CMMC 2.0? Are there any specific challenges or considerations especially for research universities?

3. For a research university, which CMMC level would be the most suitable target? Are there any key dates or deadlines that Higher Eds and researchers should be aware of in their compliance journey?

4. What are the most crucial features or elements of CMMC that universities need to achieve compliance? Any recommendations or best practices?

5. Specifically, are there any requirements in CMMC for 7/24/365 "eyes on glass" network and/or endpoint monitoring? If there is an endpoint requirement, does it extend to all servers and laptops issued by the university, or is it limited to hosts involved in research grants? What is expected to demonstrate compliance in this regard?

6. Apart from CMMC compliance, are there other considerations or or strategies to consider when seeking to qualify for/reduce cyber risk insurance costs?

How do you establish tech risk governance practices that protect the org without preventing staff from experimenting and innovating?

What do you think the CMMC (Cybersecurity Maturity Model Certification) will actually address?

Read More Comments

What platform are you using for GRC?

Drata5%

Vanta22%

Secureframe16%

KnowBe414%

Ostendio6%

AuditBoard5%

Something else -- I'll tell you in the comments6%

We’re not using a GRC platform22%

View Results

Is the edge of your enterprise secure?

Yes72%

No10%

Working on it17%

View Results

Are you already moving to quantum safe cryptography or planning to allocate budget to do so in the next year?

Read More Comments

What is your top concern around low-code/no-code tools?

Lack of visibility16%

No data oversight39%

Unknown code and security controls34%

Risk of data exposure7%

Other2%

View Results

Has your organization established an identity governance and administration (IGA) program or implemented an IGA platform solution? What do you consider to be key success factors when it comes to identity governance?

Read More Comments

Our company is considering passing the ISO 42001 (Artificial Intelligence Management System) certification. As a preparation step, we would like to start with a Gap assessment, and our business executive suggested using Modulos Agentic AI Governance Platform. It provides some methodology for fast assessment. Does anybody use it?

Read More Comments